Changelog

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability at the same time as two further reports from independent researchers.

Vercel's Attack Challenge Mode blocks attacks while securely allowing verified webhooks, search engines, and analytics tools.

Vercel's build cache now supports Yarn 2+ dependencies. Previously, dependencies were only cached for npm, pnpm, and Yarn 1.

Flags SDK 3.2 now supports precomputing pattern in SvelteKit, making it possible to use feature flags on static pages without causing layout shift or jank.

Track and analyze AI costs across models, providers, and users with Custom Reporting for Vercel AI Gateway. Tag requests, query spend by any dimension, and get full visibility into your AI usage, with no extra tools needed.

A security vulnerability in Next.js was responsibly disclosed, which allows malicious actors to bypass authorization in Middleware when targetting the x-middleware-subrequest header.

The newly released @flags-sdk/openfeature Flags SDK adapter for OpenFeature allows using any Node.js OpenFeature provider with the Flags SDK.

xAI joins the Vercel Marketplace to help users access Grok's large language models directly from their Vercel projects